Fortinet FortiAnalyzer 3.0 MR7 Instruction Manual

www.fortinet.com
FortiAnalyzer
Version 3.0 MR7
ADMINISTRATION GUIDE

FortiAnalyzer Administration Guide
Version 3.0 MR7
08 September 2008
05-30007-0082-20080908
© Copyright 2008 Fortinet, Inc. All rights reserved. No part of this
publication including text, examples, diagrams or illustrations may be
reproduced, transmitted, or translated in any form or by any means,
electronic, mechanical, manual, optical or otherwise, for any purpose,
without prior written permission of Fortinet, Inc.
Trademarks
Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC,
FortiBIOS, FortiBridge, FortiClient, FortiGate®, FortiGate Unified Threat
Management System, FortiGuard®, FortiGuard-Antispam, FortiGuard-
Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer,
FortiManager, Fortinet®, FortiOS, FortiPartner, FortiProtect,
FortiReporter, FortiResponse, FortiShield, FortiVoIP, and FortiWiFi are
trademarks of Fortinet, Inc. in the United States and/or other countries.
The names of actual companies and products mentioned herein may be
the trademarks of their respective owners.
Regulatory compliance
FCC Class A Part 15 CSA/CUS
!
CAUTION: Risk of Explosion if Battery is replaced by an Incorrect Type.
Dispose of Used Batteries According to the Instructions.

Contents
FortiAnalyzer Version 3.0 MR7 Administration Guide
05-30007-0082-20080908 3
Contents
Introduction ........................................................................................ 9
About this document......................................................................................... 9
Fortinet documentation................................................................................... 10
Fortinet Tools and Documentation CD........................................................ 10
Fortinet Knowledge Center ......................................................................... 11
Comments on Fortinet technical documentation......................................... 11
Customer service and technical support ...................................................... 11
What’s new for 3.0 MR7................................................................... 13
3.0 MR7 new features and changes ............................................................... 15
Power supply monitoring for FortiAnlayzer-2000A and 4000A ................... 15
Registered devices’ hard limits ................................................................... 15
CLI displays the tasks in the upload queue................................................. 15
Dashboard enhancements .......................................................................... 15
Custom fields for log messages .................................................................. 16
Reports........................................................................................................ 16
Report configuration enhancements..................................................... 16
VoIP reports.......................................................................................... 17
Alert email configuration changes ............................................................... 17
Administrative Domains (ADOMs).................................................. 19
About administrative domains (ADOMs)....................................................... 19
Configuring ADOMs ........................................................................................ 22
Accessing ADOMs as the admin administrator............................................ 23
Assigning administrators to an ADOM.......................................................... 24
System .............................................................................................. 25
Dashboard........................................................................................................ 25
Tabs ............................................................................................................ 27
RAID Monitor............................................................................................... 28
System Information ..................................................................................... 29
Setting the time..................................................................................... 29
Changing the host name....................................................................... 30
Changing the firmware.......................................................................... 30
License Information..................................................................................... 30
System Resources ...................................................................................... 31
Viewing operational history................................................................... 32
System Operation ....................................................................................... 33
Formatting the log disks........................................................................ 33
Resetting to the default configuration ................................................... 33
Alert Message Console ............................................................................... 34
Viewing alert console messages .......................................................... 34
Statistics...................................................................................................... 35

FortiAnalyzer Version 3.0 MR7 Administration Guide
405-30007-0082-20080908
Contents
Viewing session information ................................................................. 35
Filtering session information................................................................. 36
Report Engine ............................................................................................. 36
Log Receive Monitor ................................................................................... 37
Intrusion Activity.......................................................................................... 38
Virus Activity ............................................................................................... 39
Top FTP Traffic ........................................................................................... 40
Top Email Traffic......................................................................................... 41
Top IM/P2P Traffic ...................................................................................... 42
Top Traffic................................................................................................... 43
Top Web Traffic .......................................................................................... 44
Network ............................................................................................................ 45
Interface ...................................................................................................... 45
Changing interface settings .................................................................. 45
About Fortinet Discovery Protocol ........................................................ 47
DNS ............................................................................................................ 47
Routing........................................................................................................ 47
Adding a route ...................................................................................... 48
Admin ............................................................................................................... 48
Adding or editing an administrator account................................................. 49
Changing an administrator’s password ................................................ 50
Access Profile ............................................................................................. 50
Auth Group.................................................................................................. 51
RADIUS Server........................................................................................... 51
Administrator Settings................................................................................. 52
Monitor ........................................................................................................ 52
Network Sharing.............................................................................................. 53
Adding share users ..................................................................................... 53
Adding share groups................................................................................... 54
Configuring Windows shares ...................................................................... 54
Assigning user permissions.................................................................. 55
Configuring NFS shares.............................................................................. 55
Default file permissions on NFS shares ............................................... 56
Config ............................................................................................................... 56
Automatic file deletion and local log settings .............................................. 57
Configuring log aggregation........................................................................ 58
Configuring an aggregation client......................................................... 59
Configuring an aggregation server ....................................................... 59
Configuring log forwarding .......................................................................... 60
Configuring IP aliases ................................................................................. 60
Importing an IP alias list file.................................................................. 61
IP alias ranges...................................................................................... 62
Configuring RAID ........................................................................................ 62
RAID levels........................................................................................... 62
Hot swapping hard disks ...................................................................... 64

Contents
FortiAnalyzer Version 3.0 MR7 Administration Guide
05-30007-0082-20080908 5
Hot swapping the FortiAnalyzer-2000/2000A and FortiAnalyz-
er-4000/4000A................................................................................... 66
Configuring RAID on the FortiAnalyzer-400 and FortiAnalyzer-800/800B.
67
Configuring RAID on the FortiAnalyzer-2000/2000A and FortiAnalyz-
er-4000/4000A ................................................................................... 67
Configuring LDAP connections ................................................................... 68
Maintenance..................................................................................................... 69
Backup & Restore ....................................................................................... 69
FortiGuard Center ....................................................................................... 70
Device................................................................................................ 73
Viewing the device list .................................................................................... 73
Maximum number of devices ...................................................................... 76
Unregistered vs. registered devices............................................................ 77
Configuring unregistered device connection attempt handling ................. 79
Manually adding a device ............................................................................... 80
Classifying FortiGate network interfaces..................................................... 84
Manually adding a FortiGate unit using the Fortinet Discovery Protocol (FDP)
85
Blocking device connection attempts ........................................................... 86
Configuring device groups............................................................................. 88
Log..................................................................................................... 91
Viewing log messages .................................................................................... 91
Viewing current log messages .................................................................... 91
Viewing historical log messages ................................................................. 92
Browsing log files............................................................................................ 93
Viewing log file contents.............................................................................. 94
Importing a log file....................................................................................... 95
Downloading a log file ................................................................................. 96
Customizing the log view................................................................................ 97
Displaying and arranging log columns ........................................................ 97
Filtering logs................................................................................................ 98
Filtering tips .......................................................................................... 99
Searching the logs......................................................................................... 100
Search tips ................................................................................................ 102
Printing the search results......................................................................... 103
Downloading the search results ................................................................ 103
Rolling and uploading logs........................................................................... 104
Content Archive ............................................................................. 107
Viewing content archives.............................................................................. 107

FortiAnalyzer Version 3.0 MR7 Administration Guide
605-30007-0082-20080908
Contents
Customizing the content archive view ........................................................ 108
Displaying and arranging log columns ...................................................... 109
Filtering logs.............................................................................................. 110
Filtering tips ........................................................................................ 110
Searching full email content archives......................................................... 111
Reports ........................................................................................... 113
Configuring reports....................................................................................... 113
Configuring report layout........................................................................... 114
Editing charts in a report layout ................................................................ 116
Configuring report schedules .................................................................... 118
Configuring data filter templates ............................................................... 121
Configuring report output templates.......................................................... 123
Configuring language................................................................................ 126
Browsing reports........................................................................................... 130
Quarantine...................................................................................... 131
Viewing quarantined files ............................................................................. 131
Alert................................................................................................. 133
Alert Events.................................................................................................... 133
Adding an alert event ................................................................................ 133
Output............................................................................................................. 135
Configuring alerts by email server ............................................................ 135
Testing the mail server configuration.................................................. 136
Configuring SNMP traps and alerts .......................................................... 136
Adding an SNMP server ..................................................................... 137
FortiAnalyzer SNMP support.............................................................. 138
Configuring alerts by Syslog server .......................................................... 140
Adding a Syslog server....................................................................... 140
Network Analyzer........................................................................... 141
Connecting the FortiAnalyzer unit to analyze network traffic................... 141
Viewing Network Analyzer log messages................................................... 142
Viewing current Network Analyzer log messages..................................... 143
Viewing historical Network Analyzer log messages.................................. 143
Browsing Network Analyzer log files .......................................................... 144
Viewing Network Analyzer log file contents .............................................. 145
Downloading a Network Analyzer log file.................................................. 147
Customizing the Network Analyzer log view .............................................. 148
Displaying and arranging log columns ...................................................... 148
Filtering logs.............................................................................................. 149
Filtering tips ........................................................................................ 150

Contents
FortiAnalyzer Version 3.0 MR7 Administration Guide
05-30007-0082-20080908 7
Searching the Network Analyzer logs ......................................................... 150
Search tips ................................................................................................ 152
Printing the search results......................................................................... 153
Downloading the search results ................................................................ 153
Rolling and uploading Network Analyzer logs ........................................... 153
Tools................................................................................................ 157
Preparing for the vulnerability scan job ...................................................... 157
Preparing Windows target hosts ............................................................... 158
Preparing Unix target hosts....................................................................... 160
Viewing vulnerability scan modules............................................................ 161
Configuring vulnerability scan jobs............................................................. 162
Viewing vulnerability scan reports .............................................................. 166
File Explorer................................................................................................... 167
Managing firmware versions......................................................... 169
Backing up your configuration..................................................................... 169
Backing up your configuration using the web-based manager ................. 170
Backing up your configuration using the CLI............................................. 170
Backing up your log files ........................................................................... 170
Testing firmware before upgrading ............................................................. 172
Upgrading your FortiAnalyzer unit .............................................................. 174
Upgrading to FortiAnalyzer 3.0 ................................................................. 174
Upgrading using the web-based manager.......................................... 174
Upgrading using the CLI ..................................................................... 175
Verifying the upgrade ................................................................................ 176
Reverting to a previous firmware version................................................... 177
Downgrading to FortiLog 1.6..................................................................... 177
Verifying the downgrade ........................................................................... 178
Downgrading to FortiLog 1.6 using the CLI............................................... 178
Restoring your configuration ....................................................................... 180
Restoring configuration settings on a FortiAnalyzer unit........................... 180
Restoring your configuration settings using the web-based manager ...... 182
Restoring your configuration settings using the CLI.................................. 182

FortiAnalyzer Version 3.0 MR7 Administration Guide
805-30007-0082-20080908
Contents
Appendix: FortiAnalyzer reports in 3.0 MR7 ............................... 185
FortiGate reports ........................................................................................... 185
Intrusion Activity........................................................................................ 186
Antivirus Activity........................................................................................ 186
Webfilter Activity ....................................................................................... 189
Antispam Activity....................................................................................... 190
IM Activity.................................................................................................. 191
VoIP reports .............................................................................................. 192
Content Activity ......................................................................................... 193
Network Activity ........................................................................................ 194
Web Activity .............................................................................................. 195
Mail Activity ............................................................................................... 196
FTP Activity............................................................................................... 196
Terminal Activity........................................................................................ 197
VPN Activity .............................................................................................. 197
Event Activity ............................................................................................ 198
P2P Activity............................................................................................... 199
Audit Activity ............................................................................................. 200
Summary Reports.......................................................................................... 201
Forensic Reports........................................................................................... 202
Audit.......................................................................................................... 202
Detailed..................................................................................................... 202
Summary................................................................................................... 203
FortiMail Reports........................................................................................... 203
Mail High Level ......................................................................................... 203
Mail Sender............................................................................................... 205
Mail Recipient Activity ............................................................................... 206
Mail Destination IP .................................................................................... 206
Spam Sender ............................................................................................ 207
Spam Recipient......................................................................................... 208
Spam Destination IP ................................................................................. 209
Virus Sender ............................................................................................. 209
Virus Recipient.......................................................................................... 211
Virus Destination IP .................................................................................. 212
FortiClient Reports........................................................................................ 212
Index................................................................................................ 213

Introduction About this document
FortiAnalyzer Version 3.0 MR7 Administration Guide
05-30007-0082-20080908 9
Introduction
FortiAnalyzer units are network appliances that provide integrated log collection
and reporting tools. Reports analyze logs for email, FTP, web browsing, security
events, and other network activity to help identify security issues and reduce
network misuse and abuse.
In addition to logging and reporting, FortiAnalyzer units also have several major
features that augment or enable certain FortiGate unit functionalities, such as
content archiving and quarantining, and improve your ability to stay informed
about the state of your network.
This chapter contains the following topics:
•About this document
•Fortinet documentation
•Customer service and technical support
About this document
This document describes how to configure and use FortiAnalyzer units through
their web-based manager.
This document contains the following chapters:
•What’s new for 3.0 MR7 describes what the new maintenance release
contains.
•Administrative Domains (ADOMs) describes how to enable and configure
domain-based access to data and configurations for connected devices and
the FortiAnalyzer unit itself.
•System describes how to configure FortiAnalyzer system settings, such as
network interfaces, system time, administrators, network shares (NAS), and
local logging.
•Device describes how to configure and manage connections to the
FortiAnalyzer unit from FortiGate, FortiMail, FortiClient, FortiManager, and
Syslog device types.
•Log describes how to view logs from devices or the FortiAnalyzer unit itself. It
also describes how to customize the log view.
•Content Archive describes how to view logs and files that have been full and/or
summary content archived by FortiGate units using the FortiGate content
archiving feature.
•Quarantine describes how to view files quarantined by FortiGate units, and to
configure the quarantine disk space quota.
Note: The recommended minimum screen resolution for the management computer
connecting to the web-based manager is 1280 by 1024 pixels.

FortiAnalyzer Version 3.0 MR7 Administration Guide
10 05-30007-0082-20080908
Fortinet documentation Introduction
•Reports describes how to configure report profiles for one-time or scheduled
reports on your network devices, users, or groups.
•Alert describes how define log message criteria that signify critical network
events. As log messages arrive, if they meet those criteria, FortiAnalyzer units
send alert messages using a method of your choice: email, SNMP, or Syslog.
This chapter also lists SNMP traps that the FortiAnalyzer unit supports.
•Network Analyzer describes how to connect the FortiAnalyzer unit to a span or
mirror port on a network switch to analyze, or sniff, the network traffic passing
through the FortiAnalyzer unit.
•Tools describes how to configure vulnerability scans and view the resulting
reports as well as viewing all files on the FortiAnalyzer unit.
•Managing firmware versions describes how to properly back up your current
configuration, upgrade/downgrade firmware, and restore your configuration.
This chapter also describes how to test a firmware image before installing the
image on the FortiAnalyzer unit.
•Appendix: FortiAnalyzer reports in 3.0 MR7 describes the FortiAnalyzer reports
that changed or were moved to other categories or both. This appendix also
includes what reports were removed and what were unchanged in
FortiAnalyzer 3.0 MR7.
Fortinet documentation
The most up-to-date publications and previous releases of Fortinet product
documentation are available from the Fortinet Technical Documentation web site
at http://docs.forticare.com.
The following FortiAnalyzer product documentation is available:
• FortiAnalyzer Administration Guide
Describes how to use the web-based manager of the FortiAnalyzer unit to
configure all available features.
• FortiAnalyzer CLI Reference
Describes how to use the command line interface of the FortiAnalyzer unit to
configure all available features, CLI structure and available commands.
• FortiAnalyzer online help
Provides a searchable version of the Administration Guide in HTML format.
You can access context-appropriate online help using the online help button in
the web-based manager as you work.
• FortiAnalyzer QuickStart Guides
Describes how to install and set up the FortiAnalyzer unit.
• FortiAnalyzer Install Guide
Describes in detail how to install and set up the FortiAnalyzer unit, how to
connect to the CLI and web-based manager, default settings, and how to
manage firmware.

Introduction Customer service and technical support
FortiAnalyzer Version 3.0 MR7 Administration Guide
05-30007-0082-20080908 11
Fortinet Tools and Documentation CD
All Fortinet documentation is available from the Fortinet Tools and Documentation
CD shipped with your Fortinet product. The documents on this CD are current at
shipping time. For up-to-date versions of Fortinet documentation, see the Fortinet
Technical Documentation web site at http://docs.forticare.com.
Fortinet Knowledge Center
The knowledge center contains short how-to articles, FAQs, technical notes,
product and feature guides, and much more. Visit the Fortinet Knowledge Center
at http://kc.forticare.com.
Comments on Fortinet technical documentation
Please send information about any errors or omissions in this document, or any
Fortinet technical documentation, to [email protected].
Customer service and technical support
Fortinet Technical Support provides services designed to make sure that your
Fortinet systems install quickly, configure easily, and operate reliably in your
network.
Visit the Fortinet Technical Support web site at http://support.fortinet.com to learn
about the technical support services that Fortinet provides.

FortiAnalyzer Version 3.0 MR7 Administration Guide
12 05-30007-0082-20080908
Customer service and technical support Introduction

What’s new for 3.0 MR7
FortiAnalyzerVersion 3.0 MR7 Administration Guide
05-30007-0082-20080908 13
What’s new for 3.0 MR7
This section lists and describes the new features and changes in FortiAnalyzer
3.0 MR7. The chapter, “Managing firmware versions” on page 169, provides
detailed information about how to properly upgrade to FortiAnalyzer 3.0 MR7.
New CLI commands, as well as changes to existing CLI commands, are found in
the What’s new chapter of the FortiAnalyzer CLI Reference.
The following bulleted list includes links to other sections in this document where
you can find additional information about these new features and changes.
New features and changes for FortiAnalyzer 3.0 MR7 are:
•High-end FortiAnalyzer units support additional
terabytes (TB) of space – The higher-end FortiAnalyzer units, such as the
FortiAnalyzer-2000/2000A and FortiAnalyzer-4000/4000A, now support up to
8 TB for log disk file systems. There is no additional information available.
•Power supply monitoring feature – A new feature, power supply monitoring,
provides a notification when a power supply failure occurs or an administrator
adds a power supply to the FortiAnalyzer unit. See “Power supply monitoring
for FortiAnlayzer-2000A and 4000A” on page 15 for more information.
•Registered devices’ limits changed – Registered device limits have
increased. See “Maximum number of devices” on page 76 for more
information.
•Web-based manager change – The Action column is now an unnamed
column across all menus and tabs within the web-based manager. There is no
additional information on this change.
•CLI displays tasks in the upload queue – The command, diagnose
upload status, displays what files are waiting to be uploaded. See “CLI
displays the tasks in the upload queue” on page 15 for more information.
•Dashboard enhancements – There are several new widgets added to the
Dashboard in FortiAnalyzer, including a widget for configuring and displaying
RAID status. See “Dashboard” on page 25 for more information.
•Administration admin name enhancement – Administrators can now
configure names with the @ symbol. For additional information, see “Admin”
on page 48 in the System chapter.
•HTTPS certificates – Administrators can now change and customize (text
only) HTTPS certificates. This is only available in the CLI. See the
FortiAnalyzer CLI Reference for additional information.
•Security engine removed – The security engine feature has been removed
for FortiAnalyzer 3.0 MR7. There is no additional information available.
•Software RAID changes – When using software RAID5, the system becomes
overloaded on units with software RAID. If redundancy is required, Fortinet
now recommends RAID 10. RAID 5, unless selected from the CLI, will not
appear on the web-based manager. For additional information, see
“Configuring RAID” on page 62 in the System chapter.

FortiAnalyzerVersion 3.0 MR7 Administration Guide
14 05-30007-0082-20080908
What’s new for 3.0 MR7
•Network Summary menu removed – The Network Summary menu was
removed in FortiAnalyzer 3.0 MR7. This menu was removed because most of
the information that previously displayed, now displays as widgets on the
Dashboard. See “Dashboard” on page 25 for more information about these
new widgets that have replaced the Network Summary menu.
•Log Viewer menu enhancements – When viewing real-time logs or historical
logs, the options Resolve Host and Resolve Service are no longer available.
From within the Real-time tab, you can now view up to 1000 log messages;
you can also view up to 1000 log messages from the Historical tab as well. See
“Viewing log messages” on page 91 for more information.
•Custom fields for log messages – You can now enable custom fields for log
messages that are received from FortiGate units from the CLI. See “Custom
fields for log messages” on page 16 for more information.
•Report configuration enhancements – Reports contain several
enhancements in FortiAnalyzer 3.0 MR7, as well as the additional of VoIP
reports. See both “Report configuration enhancements” on page 16 and
“Reports” on page 113 for more information.
•Logs for HA members – Logs that are viewed on the FortiGate unit now
contain device ID fields for HA members. See the FortiGate Administration
Guide and the FortiGate Log Message Reference for additional information.
•Log search results enhancement – You can now view log search results in
both Format and Raw formats. See “Searching the logs” on page 100 for more
information.
•Alert email configuration changes – When configuring an alert email, you
are now required to enter information in the alert name field, destination field,
and device field and a drop-down list is included for selecting a destination.
See “Alert” on page 133 for more information.
•Alert emails – Alert emails now contain the FortiAnalyzer serial number in the
Source Device field in the body of the email. The FortiAnalyzer serial number
replaces the IP address of port 1 (FortiAnalyzer unit), which was used to
identify the FortiAnalyzer unit that sent the alert email. See “Alert” on page 133
for additional information about configuring alert emails.
•SNMP enhancements – When configuring SNMP communities in Alert >
Output > SNMP Access List, you can now specify that traps for certain local
system events will be generated that meet certain criteria. See “Configuring
SNMP traps and alerts” on page 136 for more information.
•File directory menu – You can now access all files that are on the
FortiAnalyzer unit in Tools > File Directory. See “File Explorer” on page 167
for more information.

What’s new for 3.0 MR7 3.0 MR7 new features and changes
FortiAnalyzerVersion 3.0 MR7 Administration Guide
05-30007-0082-20080908 15
3.0 MR7 new features and changes
The following descriptions includes only menus containing new features, changes
to features, or both. Additional information is provided within this document.
Power supply monitoring for FortiAnlayzer-2000A and 4000A
In FortiAnalyzer 3.0 MR7, the new feature power supply monitoring provides a
notification when a power supply fails or an administrator adds a power supply to
the system. This notification is sent by the hardware monitoring daemon and in
the following forms:
• Log – a log message is recorded at the system level
• Email – an email is sends out a critical event email message
• SNMP trap – a power supply event trap is sent
Both the web-based manager and CLI include settings for this new feature.
Registered devices’ hard limits
In previous FortiAnalyzer 3.0 releases, the license limits of registered devices was
reduced, causing those registered devices to not carry forward. The limit is now
back to the maximum limit in FortiAnalyzer 3.0 MR4. This limit number prevents
any loss of registered devices during upgrade. You can view the limits for
registered devices on “Maximum number of devices” on page 76 in the Device
chapter.
CLI displays the tasks in the upload queue
A new diagnose command, diagnose upload status, has been added in
FortiAnalyzer 3.0 MR7 for displaying files that are in the upload queue. Previously,
in FortiAnalyzer 3.0 MR6, a queue maintained the upload’s tasks but there was no
way of verifying what was and what was not included in the queue.
Dashboard enhancements
The Dashboard contains nine new widgets in FortiAnalyzer 3.0 MR7.
Administrators can have up to five tabs to the Dashboard as well.
Tabs allow administrators to customize what widgets display, for example, if
administrators only need to view traffic widgets a tab can be configured so that it
only displays all the traffic widgets.
The following are the new widgets that are available for display on the Dashboard:
• Log Receive Monitor
• RAID Monitor (if RAID is available on the FortiAnalyzer unit)
•TopTraffic
• Top Web Traffic
• Top Email Traffic
•TopFTPTraffic
• Top IM/P2P Traffic
• Virus Activity
• Intrusion Activity

FortiAnalyzerVersion 3.0 MR7 Administration Guide
16 05-30007-0082-20080908
3.0 MR7 new features and changes What’s new for 3.0 MR7
For the Log Receive Monitor widget, a diagnose command will be introduced to
provide information about total message rate, message rate per-protocol, and
message rate per-device in the CLI.
See “System” on page 25 for information about the new widgets for FortiAnalyzer
3.0 MR7.
Custom fields for log messages
In FortiAnalyzer 3.0 MR7, you can now enable custom fields for log messages so
that when the FortiAnalyzer unit receives these types of log messages, it can
index them properly for reports or searching logs.
This feature is enabled only in the CLI using the following command syntax:
config log settings
set custom-field<1-5>
The previous logs require re-indexing for this feature to be effective on them, and
is only available in the CLI using the diagnose log-indexer command. This
particular command can index per device and type, or all devices.
Reports
Reports have been enhanced and modified for FortiAnalyzer 3.0 MR7. VoIP report
charts were also included in FortiAnalyzer 3.0 MR7. These changes are also
reflected in the CLI. See the FortiAnalyzer CLI Reference for additional
information about the associated commands.
Report configuration enhancements
Report configuration has changed dramatically from FortiAnalyzer 3.0 MR6 to
FortiAnalyzer 3.0 MR7. These changes are also reflected in the FortiGate unit’s
web-based manager and CLI. These dramatic changes do not affect previously
configured reports in FortiAnalyzer 3.0 MR6 and earlier; however, you may want
to reconfigure certain settings to simplify the previously configured reports.
These previously configured reports are separated based on what is included; for
example, if DeviceSummary1_layout contains filters and output settings, the filters
will be put in the Data Filter tab and given a name, and the output settings will be
put in the Output tab and also given a name.
Figure 1: The previous FortiAnalyzer 3.0 MR6 reports, outlined in red, carried
forward to FortiAnalyzer 3.0 MR7 and displayed in Layout with default
report layouts

What’s new for 3.0 MR7 3.0 MR7 new features and changes
FortiAnalyzerVersion 3.0 MR7 Administration Guide
05-30007-0082-20080908 17
Fortinet recommends configuring a test report layout and report schedule to
familiarize yourself with how reports are configured in FortiAnalyzer 3.0 MR7. See
“Reports” on page 113 about how to configure reports in FortiAnalyzer 3.0 MR7.
In Report > Config, new tabs were added: Layout, Data Filter, Output, and
Language. These new tabs allow you to configure multiple data filters, output
destinations, report layouts (previously referred to as report profiles), and
languages. The new menu, Schedule, provides settings and options for
configuring a scheduled report.
Previously, you could configure specific report layouts such as Device Summary,
Forensic, and User/Client report profiles. These report types were combined with
other report types and removed from their respective tabs, which now provide
greater flexibility for configuring report layouts. Forensic report options are now
available when you select [Add Chart(s)] from the Chart List section of Report
Layout.
Report schedules should be configured after configuring the report layout
because you need to apply the report layout to the report schedules. Report
schedules can also be configured from the FortiGate unit’s web-based manager.
After configuring a report, you can generate that report immediately by selecting
Run Now and view it in Report > Browse. You can also generate scheduled
reports this way in Report > Schedule.
When viewing generated reports in Report Browse, the naming scheme is
changed to the following:
•On-Demand-<name of report>-<yyyy-mm-dd>-<time initiated by
admin_hhmm> – for reports that are generated immediately, for example:
On-Demand-Report_Headquarters-2008-06-03-0830
•<name of scheduled report>-<yyyy-mm-dd>-<time_scheduled>
– all other reports, for example:
Report_Headquarters-2008-05-26-1030
These generated reports in Report Browse also contain only one rolled report
when you expand a report. The name of rolled reports has changed as well and
each is named after the section title that was configured in Layout. For example, if
you had two section titles, Top Web Attacks and Top Viruses, the rolled reports
would be named Top Web Attacks and Top Viruses. The default name for the
rolled report is FortiAnalyzer Report. If generated reports carry forward from
FortiAnalyzer 3.0 MR6, rolled reports might be renamed to the default name,
FortiAnalyzer Report.
VoIP reports
VoIP activities and events are now available in reports. There are three log files
that contain VoIP activity and event information: tlog.log, plog.log and clog.log.
These log will be used for the following information:
• tlog.log – number of bytes pass per session
• plog.log – blocked VoIP activity
• clog.log – user registration information and call duration information
The individual reports that you select when configuring a report are available in
the Fortinet Knowledge Center article, FortiAnalyzer Reports in 3.0 MR7, on the
Fortinet Knowledge Center website.

FortiAnalyzerVersion 3.0 MR7 Administration Guide
18 05-30007-0082-20080908
3.0 MR7 new features and changes What’s new for 3.0 MR7
Alert email configuration changes
When configuring an alert email in Alert > Alert Event, you now are required to
enter information in the following fields:
•alertname
• destination (or destinations)
• device
Another configuration change is a drop-down list, providing the destinations of
syslog servers, mail servers and SNMP access lists. The Syslog servers and
SNMP access lists only display in the list when configured in Alert > Output.
Figure 2: The Destination drop-down list, circled, provides three destinations

Administrative Domains (ADOMs) About administrative domains (ADOMs)
FortiAnalyzer Version 3.0 MR7 Administration Guide
05-30007-0082-20080908 19
Administrative Domains (ADOMs)
Administrative Domains (ADOMs) enable the admin administrator to constrain
other FortiAnalyzer unit administrators’ access privileges to a subset of devices in
the device list. For FortiGate devices with virtual domains (VDOMs), ADOMs can
further restrict access to only data from a specific FortiGate VDOM.
This section includes the following topics:
•About administrative domains (ADOMs)
•Configuring ADOMs
About administrative domains (ADOMs)
Enabling ADOMs alters the structure and available functionality of the web-based
manager and CLI according to whether you are logging in as the admin
administrator, and, if you are not logging in as the admin administrator, the
administrator account’s assigned access profile.
Table 1: Characteristics of the CLI and web-based manager when ADOMs are
enabled
admin administrator account Other administrators
Access to Global
Configuration
Yes No
Access to Administrative
Domain Configuration (can
create ADOMs)
Yes No
Can create administrator
accounts
Yes No
Can enter all ADOMs Yes No

FortiAnalyzer Version 3.0 MR7 Administration Guide
20 05-30007-0082-20080908
About administrative domains (ADOMs) Administrative Domains (ADOMs)
• If ADOMs are enabled and you log in as admin, you first access
Administration Domain Configuration. A superset of the typical menus and CLI
commands appear, allowing unrestricted access and ADOM configuration.
• Global Configuration contains settings used by the FortiAnalyzer unit itself
and settings shared by ADOMs, such as the device list, RAID, and
administrator accounts. It does not include ADOM-specific settings or data,
such as logs and reports. When configuring other administrator accounts,
an additional option appears allowing you to restrict other administrators to
an ADOM.
If you enter Global Configuration, a Main Menu item appears in the menu,
enabling you to return to the top level menu area, Administrative Domain
Configuration.
• Administrative Domains allows you to configure or access ADOMs. You can
add a device to one or more ADOMs. If you enter an ADOM, a Main Menu
item appears in the menu, enabling you to return to the top level menu
area, Administrative Domain Configuration.
Table 2: Configuration locations when ADOMs are enabled
Within Global Configuration: Within each ADOM:
System > Dashboard (includes tabs, if
configured)
System > Network > Interface
System > Network > DNS
System > Network > Routing
System > Admin > Administrator
System > Admin > Access Profile
System > Admin > Auth Group
System > Admin > RADIUS Server
System > Admin > Settings
System > Admin > Monitor
System > Network Sharing > Windows
Share
System > Network Sharing > NFS Export
System > Network Sharing > User
System > Network Sharing > Group
System > Config > Log Setting
System > Config > Log Aggregation
System > Config > Log Forwarding
System > Config > RAID
System > Maintenance > Backup &
Restore
System > Maintenance > FortiGuard
Center
Device > All > Device (devices assigned to
an ADOM other than root cannot be
deleted)
Device > All > Blocked Device
Log > Config > Log Config
Report > Config > Language
Quarantine > Config > Quarantine Config
Alert > Alert Event > Alert Event
Alert > Output > SNMP Access List
Alert > Output > Syslog Server
Tools > Vulnerability Scan > Module
Tools > File Explorer > File Explorer
System > Config > IP Alias
System > Config > LDAP
Device > All > Device (read only)
Device > All > Group
Log > Log Viewer > Real-time
Log > Log Viewer > Historical
Log > Search > Log Search
Log > Browse > Log Browser
Content Archive > Web Archive
Content Archive > Email Archive
Content Archive > File Transfer
Content Archive > IM Chat
Content Archive > VoIP Archive
Report > Browse > Result
Report > Schedule > Schedule
Report > Config > Layout
Report > Config > Data Filter
Report > Config > Output
Quarantine > Repository > Repository
Alert > Output > Mail Server
Tools > Vulnerability Scan > Job
Tools > Vulnerability Scan > Report
Tools > File Explorer > File Explorer